b104760b3a
Standardize role string VALUES on the canonical vocabulary
(Administrator/Designer/Deployer/Viewer; Operator/Engineer unused here):
Admin -> Administrator
Design -> Designer
Deployment -> Deployer
Audit -> Administrator (COLLAPSE; accepted privilege escalation)
AuditReadOnly-> Viewer (COLLAPSE; keeps audit-read, no export)
SoD: OperationalAuditRoles = { Administrator, Viewer },
AuditExportRoles = { Administrator }
so Viewer reads the audit log + nav but cannot bulk-export, while
Administrator does both + holds the full admin surface (the documented,
accepted auditor/admin SoD collapse).
Atomic move across every enforcement site:
- Roles constants; AuthorizationPolicies (RequireClaim values + SoD arrays +
honest XML-doc); RoleMapper Deployer check.
- ManagementActor.GetRequiredRole switch + the hard-coded site-scope
admin-bypass (now Roles.Administrator at all 6 sites). Site-scoping logic
is otherwise unchanged.
- DebugStreamHub Administrator/Deployer gates (Deployer kept case-sensitive).
- CentralUI BrowseService/BindingTester Designer guards; LdapMappingForm
dropdown now offers canonical values (incl. Viewer).
- Config-DB seed (LdapGroupMappings Id 1-4) + EF migration CanonicalizeRoles:
Id-keyed UpdateData for seed rows + idempotent raw catch-all UPDATEs for
operator-added rows. Down is lossy on the collapse (documented in-file).
No pending model changes.
Tests reworked to the collapsed model across Security/CentralUI/
ManagementService/ConfigurationDatabase/Integration suites, incl. explicit
Viewer-reads-not-exports and former-Audit-now-Administrator-escalation cases.
CHANGELOG: BREAKING security note documenting the canonicalization + SoD
collapse.
114 lines
4.0 KiB
C#
114 lines
4.0 KiB
C#
using System.Security.Claims;
|
|
using ZB.MOM.WW.ScadaBridge.Security;
|
|
using Bunit;
|
|
using Microsoft.AspNetCore.Components.Authorization;
|
|
using Microsoft.Extensions.DependencyInjection;
|
|
using NSubstitute;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Entities.Notifications;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
|
|
using SmtpConfigurationPage = ZB.MOM.WW.ScadaBridge.CentralUI.Components.Pages.Notifications.SmtpConfiguration;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Pages;
|
|
|
|
/// <summary>
|
|
/// bUnit rendering tests for the SMTP Configuration page — specifically the TlsMode
|
|
/// field added so the UI exposes all five user-relevant SmtpConfiguration fields.
|
|
/// </summary>
|
|
public class SmtpConfigurationPageTests : BunitContext
|
|
{
|
|
private void WireAuth()
|
|
{
|
|
var claims = new[]
|
|
{
|
|
new Claim(JwtTokenService.UsernameClaimType, "tester"),
|
|
new Claim(JwtTokenService.RoleClaimType, "Administrator"),
|
|
};
|
|
var user = new ClaimsPrincipal(new ClaimsIdentity(claims, "TestAuth"));
|
|
Services.AddSingleton<AuthenticationStateProvider>(new TestAuthStateProvider(user));
|
|
Services.AddAuthorizationCore();
|
|
}
|
|
|
|
private static SmtpConfiguration Sample() =>
|
|
new("smtp.example.com", "Basic", "noreply@example.com")
|
|
{
|
|
Id = 1,
|
|
Port = 587,
|
|
TlsMode = "StartTLS",
|
|
Credentials = "user:pass",
|
|
};
|
|
|
|
[Fact]
|
|
public void EditForm_RendersTlsModeSelectWithAllThreeModes()
|
|
{
|
|
var repo = Substitute.For<INotificationRepository>();
|
|
repo.GetAllSmtpConfigurationsAsync()
|
|
.Returns(Task.FromResult<IReadOnlyList<SmtpConfiguration>>(
|
|
new List<SmtpConfiguration> { Sample() }));
|
|
Services.AddSingleton(repo);
|
|
WireAuth();
|
|
|
|
var cut = Render<SmtpConfigurationPage>();
|
|
cut.WaitForState(() => cut.Markup.Contains("smtp.example.com"));
|
|
|
|
cut.FindAll("button").First(b => b.TextContent.Contains("Edit")).Click();
|
|
|
|
cut.WaitForAssertion(() =>
|
|
{
|
|
var selects = cut.FindAll("select");
|
|
var tlsSelect = selects.Single(s => s.QuerySelectorAll("option")
|
|
.Any(o => o.TextContent == "StartTLS"));
|
|
var modes = tlsSelect.QuerySelectorAll("option").Select(o => o.TextContent).ToList();
|
|
Assert.Equal(new[] { "None", "StartTLS", "SSL" }, modes);
|
|
});
|
|
}
|
|
|
|
[Fact]
|
|
public void ReadOnlyView_ShowsTlsMode()
|
|
{
|
|
var repo = Substitute.For<INotificationRepository>();
|
|
repo.GetAllSmtpConfigurationsAsync()
|
|
.Returns(Task.FromResult<IReadOnlyList<SmtpConfiguration>>(
|
|
new List<SmtpConfiguration> { Sample() }));
|
|
Services.AddSingleton(repo);
|
|
WireAuth();
|
|
|
|
var cut = Render<SmtpConfigurationPage>();
|
|
|
|
cut.WaitForAssertion(() =>
|
|
{
|
|
Assert.Contains("TLS Mode", cut.Markup);
|
|
Assert.Contains("StartTLS", cut.Markup);
|
|
});
|
|
}
|
|
|
|
[Fact]
|
|
public void SavingEdit_PersistsChosenTlsMode()
|
|
{
|
|
var config = Sample();
|
|
var repo = Substitute.For<INotificationRepository>();
|
|
repo.GetAllSmtpConfigurationsAsync()
|
|
.Returns(Task.FromResult<IReadOnlyList<SmtpConfiguration>>(
|
|
new List<SmtpConfiguration> { config }));
|
|
Services.AddSingleton(repo);
|
|
WireAuth();
|
|
|
|
var cut = Render<SmtpConfigurationPage>();
|
|
cut.WaitForState(() => cut.Markup.Contains("smtp.example.com"));
|
|
|
|
cut.FindAll("button").First(b => b.TextContent.Contains("Edit")).Click();
|
|
|
|
var tlsSelect = cut.FindAll("select")
|
|
.Single(s => s.QuerySelectorAll("option").Any(o => o.TextContent == "StartTLS"));
|
|
tlsSelect.Change("SSL");
|
|
|
|
cut.FindAll("button").First(b => b.TextContent.Contains("Save")).Click();
|
|
|
|
cut.WaitForAssertion(() =>
|
|
{
|
|
repo.Received().UpdateSmtpConfigurationAsync(
|
|
Arg.Is<SmtpConfiguration>(c => c.TlsMode == "SSL"));
|
|
repo.Received().SaveChangesAsync();
|
|
});
|
|
}
|
|
}
|